From 5ce698f42137b283ae68ba6d109e322629dfa413 Mon Sep 17 00:00:00 2001 From: David Herberth Date: Fri, 3 Nov 2023 13:22:16 +0100 Subject: [PATCH] feat(py): Add validate_pii_selector_spec --- CHANGELOG.md | 1 + py/CHANGELOG.md | 4 +++ py/sentry_relay/processing.py | 12 +++++++++ py/tests/test_processing.py | 18 ++++++++++++++ relay-cabi/include/relay.h | 5 ++++ relay-cabi/src/processing.rs | 46 +++++++++++++++++++++++------------ 6 files changed, 71 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 81484b77359..c6900d52005 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ - Filter outliers (>180s) for mobile measurements. ([#2649](https://github.com/getsentry/relay/pull/2649)) - Allow access to more context fields in dynamic sampling and metric extraction. ([#2607](https://github.com/getsentry/relay/pull/2607), [#2640](https://github.com/getsentry/relay/pull/2640), [#2675](https://github.com/getsentry/relay/pull/2675)) - Allow advanced scrubbing expressions for datascrubbing safe fields. ([#2670](https://github.com/getsentry/relay/pull/2670)) +- Add `validate_pii_selector_spec` to CABI for safe fields validation. ([#2687](https://github.com/getsentry/relay/pull/2687)) **Bug Fixes**: diff --git a/py/CHANGELOG.md b/py/CHANGELOG.md index 603953f9752..89d3375afb7 100644 --- a/py/CHANGELOG.md +++ b/py/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## Unreleased + +- Add `validate_pii_selector_spec` to validate safe fields. ([#2687](https://github.com/getsentry/relay/pull/2687)) + ## 0.8.33 - Drop events starting or ending before January 1, 1970 UTC. ([#2613](https://github.com/getsentry/relay/pull/2613)) diff --git a/py/sentry_relay/processing.py b/py/sentry_relay/processing.py index 0914c1f811d..95554b0c969 100644 --- a/py/sentry_relay/processing.py +++ b/py/sentry_relay/processing.py @@ -21,6 +21,7 @@ "is_glob_match", "is_codeowners_path_match", "parse_release", + "validate_pii_selector_spec", "validate_pii_config", "convert_datascrubbing_config", "pii_strip_event", @@ -166,6 +167,17 @@ def is_codeowners_path_match(value, pattern): ) +def validate_pii_selector_spec(selector): + """ + Validate a PII selector spec. Used to validate datascrubbing safe fields. + """ + assert isinstance(selector, str) + raw_error = rustcall(lib.relay_validate_pii_selector_spec, encode_str(selector)) + error = decode_str(raw_error, free=True) + if error: + raise ValueError(error) + + def validate_pii_config(config): """ Validate a PII config against the schema. Used in project options UI. diff --git a/py/tests/test_processing.py b/py/tests/test_processing.py index 452d98dd256..487268fcc93 100644 --- a/py/tests/test_processing.py +++ b/py/tests/test_processing.py @@ -128,6 +128,24 @@ def test_normalize_user_agent(must_normalize): assert "contexts" not in event +def test_validate_pii_selector_spec(): + sentry_relay.validate_pii_selector_spec("test") + sentry_relay.validate_pii_selector_spec("$user.id") + sentry_relay.validate_pii_selector_spec("extra.'sys.argv'.**") + + with pytest.raises(ValueError) as e: + sentry_relay.validate_pii_selector_spec("no_spaces allowed") + assert "1 | no_spaces allowed" in str(e.value) + + with pytest.raises(ValueError) as e: + sentry_relay.validate_pii_selector_spec("unterminated.'string") + assert "expected QuotedCharacter" in str(e.value) + + with pytest.raises(ValueError) as e: + sentry_relay.validate_pii_selector_spec("double.**.wildcard.**") + assert "deep wildcard used more than once" in str(e.value) + + def test_validate_pii_config(): sentry_relay.validate_pii_config("{}") sentry_relay.validate_pii_config('{"applications": {}}') diff --git a/relay-cabi/include/relay.h b/relay-cabi/include/relay.h index 55a1ea451ec..9b15aed027c 100644 --- a/relay-cabi/include/relay.h +++ b/relay-cabi/include/relay.h @@ -552,6 +552,11 @@ struct RelayStr relay_store_normalizer_normalize_event(struct RelayStoreNormaliz */ bool relay_translate_legacy_python_json(struct RelayStr *event); +/** + * Validates a PII selector spec. Used to validate datascrubbing safe fields. + */ +struct RelayStr relay_validate_pii_selector_spec(const struct RelayStr *value); + /** * Validate a PII config against the schema. Used in project options UI. */ diff --git a/relay-cabi/src/processing.rs b/relay-cabi/src/processing.rs index 78dfd3e9cb7..a52462b4a17 100644 --- a/relay-cabi/src/processing.rs +++ b/relay-cabi/src/processing.rs @@ -19,6 +19,7 @@ use relay_event_schema::processor::{process_value, split_chunks, ProcessingState use relay_event_schema::protocol::{Event, VALID_PLATFORMS}; use relay_pii::{ selector_suggestions_from_value, DataScrubbingConfig, PiiConfig, PiiConfigError, PiiProcessor, + SelectorSpec, }; use relay_protocol::{Annotated, Remark, RuleCondition}; use relay_sampling::SamplingConfig; @@ -150,6 +151,16 @@ pub unsafe extern "C" fn relay_translate_legacy_python_json(event: *mut RelayStr true } +/// Validates a PII selector spec. Used to validate datascrubbing safe fields. +#[no_mangle] +#[relay_ffi::catch_unwind] +pub unsafe extern "C" fn relay_validate_pii_selector_spec(value: *const RelayStr) -> RelayStr { + match (*value).as_str().parse::() { + Ok(_) => RelayStr::new(""), + Err(e) => RelayStr::from_string(e.to_string()), + } +} + /// Validate a PII config against the schema. Used in project options UI. #[no_mangle] #[relay_ffi::catch_unwind] @@ -336,9 +347,13 @@ pub unsafe extern "C" fn normalize_global_config(value: *const RelayStr) -> Rela } } -#[test] -fn pii_config_validation_invalid_regex() { - let config = r#" +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn pii_config_validation_invalid_regex() { + let config = r#" { "rules": { "strip-fields": { @@ -355,15 +370,15 @@ fn pii_config_validation_invalid_regex() { } } "#; - assert_eq!( - unsafe { relay_validate_pii_config(&RelayStr::from(config)).as_str() }, - "regex parse error:\n (not valid regex\n ^\nerror: unclosed group" - ); -} + assert_eq!( + unsafe { relay_validate_pii_config(&RelayStr::from(config)).as_str() }, + "regex parse error:\n (not valid regex\n ^\nerror: unclosed group" + ); + } -#[test] -fn pii_config_validation_valid_regex() { - let config = r#" + #[test] + fn pii_config_validation_valid_regex() { + let config = r#" { "rules": { "strip-fields": { @@ -380,8 +395,9 @@ fn pii_config_validation_valid_regex() { } } "#; - assert_eq!( - unsafe { relay_validate_pii_config(&RelayStr::from(config)).as_str() }, - "" - ); + assert_eq!( + unsafe { relay_validate_pii_config(&RelayStr::from(config)).as_str() }, + "" + ); + } }